2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe
Size

700KB
MD5

f976b4f177f79502215c7d2d9e93ee16
SHA1

97f888337aae22e27eed57deb4b85cdff13c576a
SHA256

2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582
SHA512

e41bcc684fcf5651f0812beb4d97fae71122dc5468c185e250071d2c69f8b3c5d2237a052b90fa3cb674c4d956c5caa17190aa28f8c07c02c97ad17b6bb6754a
SSDEEP

6144:9SvGAafgBMniUwluzlcy/XVucQ5p6SLGn+xfhXr3uwlLycLRLy9vfz:4Gfg2i8VucQ5p60V3usLBcNz

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3008	2252	WerFault.exe	2
2188	1048	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 1048	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	29
PID 2252 wrote to memory of 3008	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	30
PID 2252 wrote to memory of 3008	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	30
PID 2252 wrote to memory of 3008	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	30
PID 2252 wrote to memory of 3008	2252	2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe	30
PID 1048 wrote to memory of 2188	1048	AppLaunch.exe	31
PID 1048 wrote to memory of 2188	1048	AppLaunch.exe	31
PID 1048 wrote to memory of 2188	1048	AppLaunch.exe	31
PID 1048 wrote to memory of 2188	1048	AppLaunch.exe	31
PID 1048 wrote to memory of 2188	1048	AppLaunch.exe	31
PID 1048 wrote to memory of 2188	1048	AppLaunch.exe	31
PID 1048 wrote to memory of 2188	1048	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe
"C:\Users\Admin\AppData\Local\Temp\2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 196
    3⤵
    - Program crash
    PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 92
  2⤵
  - Program crash
  PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1048-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1048-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads